Georgia Tech sued by US for a litany of security failings

TLDR:

Key Points:

• The US is suing Georgia Tech over alleged failures to meet cybersecurity standards set by the Department of Defense (DoD).
• Whistleblowers reported failures to protect controlled unclassified information at the university.

Article Summary:

The article discusses the lawsuit filed by the US against Georgia Tech, alleging a series of security failings that put national security and defense personnel at risk. The lawsuit was initiated following whistleblower reports from insiders Christopher Craig and Kyle Koza about alleged failures to meet cybersecurity standards set by the DoD. The allegations include Georgia Tech’s failure to implement proper cybersecurity plans, refusal to deploy anti-malware solutions, and submission of fraudulent cybersecurity assessment scores. The case is being pursued under the False Claims Act and the Civil Cyber-Fraud Initiative, marking the first-of-its-kind case brought under the initiative.

Furthermore, the article mentions a separate congressional probe into Georgia Tech’s partnership with Tianjin University in China, raising concerns about potential ties to the Chinese military. The investigation is ongoing, and the outcome is yet to be determined. The article highlights the implications of these security failings not only for national security but also for the safety of armed services personnel, emphasizing the importance of strict cybersecurity controls for government contractors.

The defendants in the case, Georgia Tech and its contracting entity GTRC, are accused of knowingly violating cybersecurity requirements and certifications, showcasing a potential liability under the FCA. The article underscores the significance of cybersecurity compliance in the context of national security and emphasizes the government’s commitment to holding entities accountable for security lapses.